In a resolution on Thursday 11 May the European Parliament did not support the European Commission’s adequacy decision on transfers of personal data between the EU and the US (see EUROPE 13161/2). In a resolution adopted with 306 votes in favour, 27 against and 231 abstentions in plenary, MEPs acknowledged the improvements in the new framework, but deemed them insufficient to withstand legal challenges.
This is in fact the third legal framework allowing the transfer of data between the EU and the US. The previous Safe Harbour (see EUROPE 11404/1) and Privacy Shield (see EUROPE 12529/2) were both invalidated by the Court of Justice of the EU (CJEU).
Gaps
“There are still missing elements on judicial independence, transparency, access to justice, and remedies. So, we call on the Commission to continue negotiations and properly address these concerns”, summarised rapporteur Juan Fernando López Aguilar (S&D, Spanish).
The European Parliament resolution challenges, among other things, the functioning of the Data Protection Review Court. While this body will allow EU citizens to lodge appeals, its decisions will be secret, thus violating people’s right to access and rectify their data. The text also calls into question its independence from the US executive.
Furthermore, the resolution notes that the new framework continues to allow the bulk collection of personal data and does not provide clear rules on their retention.
Speaking at a debate on the subject the day before, Commissioner for Justice Didier Reynders defended the framework. He considers it to address the shortcomings previously identified by the CJEU, namely “insufficient safeguards in terms of necessity and proportionality as regards access to personal data by US intelligence agencies” and “insufficient safeguards in terms of individual redress in this area”.
Small majority
Indeed, one of the arguments put forward by all parties in the debate is the need to ensure continuity of protection for citizens on the one hand and legal certainty for businesses on the other.
However, those who defend the framework believe that it strikes the right balance between data protection and the pursuit of public interest objectives (such as national security), allowing it to be accepted by the CJEU. Its completion, they argue, will therefore provide this legal certainty. On the contrary, those calling on the Commission to reconsider doubt that the framework will stand up to the test of the Court of Justice and, in their view, finalising its adoption would therefore create more uncertainty.
The EPP group proposed a series of amendments to qualify the initial resolution, calling on the Commission to monitor the implementation of the framework without calling it into question. While these amendments were ultimately rejected, the European Parliament’s lack of support for the decision was by a slim majority, with a large proportion of the EPP and ECR groups, as well as some of the Renew Europe and ID groups, abstaining.
See the resolution: https://aeur.eu/f/6u6 (Original version in French by Hélène Seynaeve)